@ -1,13 +1,14 @@
server.document-root = "/srv/http/"
server.error-handler-404 = "/errors/404.php"
server.document-root = "/srv/http/aninix.net/"
server.port = 80
server.error-handler-404 = "/srv/http/errors/404.html"
server.errorlog = "/var/log/lighttpd/error.log"
accesslog.filename = "/var/log/lighttpd/access.log"
server.username = "http"
server.groupname = "http"
server.follow-symlink = "enable"
static-file.exclude-extensions = ( ".fcgi", ".php", ".rb", "~", ".inc" )
index-file.names = ( "index.html","index.php","root.php" )
index-file.names = ( "index.html", "index.php" )
# We aren't afraid to tag with our patch cycle.
server.tag = "AniNIX WebServer (powered by ShadowArch Linux and lighttpd)"
url.access-deny = ( "~", ".inc", ".." )
server.modules = (
@ -18,20 +19,9 @@ server.modules = (
"mod_accesslog",
"mod_auth",
"mod_proxy",
"mod_setenv",
)
# Includes
include "conf.d/*.conf"
# Authorization
auth.backend = "htdigest"
auth.backend.ldap.hostname = "localhost"
auth.backend.ldap.base-dn = "ou=People,dc=aninix,dc=net"
auth.backend.ldap.allow-empty-pw = "disable"
# Enable SSL by virtual host
# Redirects for empty virtualhosting.
## AniNIX::WebServer
# Deny HTTP
$HTTP["scheme"] == "http" {
@ -39,22 +29,31 @@ $HTTP["scheme"] == "http" {
url.redirect = ( ".*" => "https://%0$0" )
}
}
# Allow HTTPS
# Adding notes from https://cipherli.st/ on response headers and HSTS
setenv.add-response-header = (
"Strict-Transport-Security" => "max-age=63072000; includeSubDomains; preload",
"X-Frame-Options" => "DENY",
"X-Content-Type-Options" => "nosniff"
)
# Use HTTPS through Virtual Hosting.
# Redirects for empty virtualhosting.
$SERVER["socket"] == ":443" {
ssl.engine = "enable"
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
ssl.disable-client-renegotiation = "enable"
ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES128+EECDH:AES128+EDH"
ssl.pemfile = "/etc/letsencrypt/live/aninix.net/certkey.pem"
ssl.ca-file = "/etc/letsencrypt/live/aninix.net/fullchain.pem"
ssl.honor-cipher-order = "enable"
# Including cipher list from https://www.ssllabs.com/projects/best-practices/index.html (Modified)
ssl.cipher-list = "!NULL:!SSLv2:!SSLv3:!TLSv1:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
ssl.dh-file = "/etc/ssl/certs/dhparam.pem"
ssl.ec-curve = "secp384r1"
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
ssl.disable-client-renegotiation = "enable"
# Virtual hosting for aninix.net
$HTTP["host"] =~ "(^|www\.)aninix\.net$" {
server.document-root = "/srv/http/aninix.net/"
}
server.document-root = "/srv/http/aninix.net/"
}
}
#Define mimetypes.
@ -116,8 +115,8 @@ mimetype.assign = (
#### auth module
## read authentication.txt for more info
#auth.backend = "plain"
#auth.backend.plain.userfile = "lighttpd.user "
#auth.backend.plain.groupfile = "lighttpd.group "
#auth.backend.plain.userfile = "user.lighttpd.conf "
#auth.backend.plain.groupfile = "group.lighttpd.conf "
#auth.backend.ldap.hostname = "localhost"
#auth.backend.ldap.base-dn = "dc=my-domain,dc=com"
#auth.backend.ldap.filter = "(uid=$)"
@ -138,6 +137,7 @@ mimetype.assign = (
### Unused modules ###
# "mod_trigger_b4_dl",
# "mod_auth",
# "mod_status",
@ -150,7 +150,7 @@ mimetype.assign = (
# "mod_simple_vhost",
# "mod_evhost",
# "mod_userdir",
# "mod_fastcgi",
# "mod_fastcgi",
# "mod_compress",
# "mod_ssi",
# "mod_usertrack",
@ -160,5 +160,7 @@ mimetype.assign = (
# "mod_accesslog"
#)
# Includes
include "conf.d/*.conf"
DarkFeather
6 years ago